Privacy Policy
Effective date: 16 Aug 2026
Schedulyr is a booking platform. Each business that uses it gets its own booking site on its own subdomain. This policy has two parts: what the platform itself collects from the owner who signs up, and what happens to the information that business then collects from its own clients. Schedulyr is operated by Kobe Sagami, at 805-230 Roslyn Rd, Winnipeg MB CA R3L 0H1.
When a business signs up, it is the client, and Schedulyr is the service it uses. When that business's clients book on its site, the business is in charge of their information, and Schedulyr is the processor that stores and handles it on the business's instructions. The two roles are explained below.
What the platform collects when you sign up
When an owner registers, Schedulyr collects only what the signup form asks for:
- The business name
- The owner's email address
- A password, stored only as a bcrypt hash and never in plain text
- The subdomain the owner chooses, for example sarah.schedulyr.com
To finish signing up, the platform emails a verification link to that address. The link carries a single-use token that expires after 24 hours. The raw token is never stored, only a one-way hash of it.
Payments
Platform subscription billing is handled by Stripe, a third-party payment processor. Card numbers are collected and stored by Stripe, never by this platform.
When an owner starts the free trial, Stripe sends the platform the payment status, the last four digits of the card, the billing email, and the subscription and customer identifiers for the account. The platform uses these to run the subscription, send receipts and payment notices, and enforce the paused state when a charge has not been resolved. This is separate from the Stripe account a business can connect to collect deposits from its own clients, which is described later in this policy.
The card number itself never reaches the platform, and the platform cannot change the card on file or charge it directly. Those actions happen through Stripe and through the Stripe billing portal.
Sessions, cookies, and what we keep on your device
- A server-side session, held in an httpOnly cookie, keeps an admin signed in and guards against cross-site request forgery.
- If the owner chooses, the admin email is remembered on that device so the next login is faster. That value lives in the browser's local storage, not on our servers.
- IP addresses are used for rate limiting and to block abusive requests. They are not used to profile visitors.
- When Cloudflare Turnstile is enabled on the signup form, the captcha widget runs in the browser and sends its result to Cloudflare, which the server verifies before an account is created.
There are no advertising cookies, no analytics trackers, and no cross-site tracking. Nothing is sold, and nothing is shared for advertising.
Who we share with
Schedulyr shares account data only with the providers needed to run the platform:
- An email provider, which delivers verification and account messages
- A hosting provider, which stores the platform's servers and databases
- A Postgres registry, which holds the list of tenants and owner accounts
- Stripe, the payment processor that handles platform subscription billing and the deposits each business collects from its clients
Each provider receives only what it needs to do its job. A business can also connect its own Stripe and Twilio accounts to take deposits and send text messages. Those connections are that business's own, and card details never pass through Schedulyr's servers. The same rule applies to platform billing: card numbers are held by Stripe and never by the platform.
Information about your clients
A business's booking site collects information from that business's own clients: names, contact details, the appointments they book, answers to intake forms, signatures, and any files they upload. That business decides what it asks for and how long it keeps it. Under the booking relationship, the business is the controller of that data, and Schedulyr is the processor.
As the processor, Schedulyr hosts the data and provides the tools, but it does not use the data for its own purposes, and it does not sell or share it. The business is responsible for complying with the privacy laws that apply to its own collection of client information, including any notice or consent requirements.
How long we keep information
Pending signups are held until their verification token expires, and the token itself is single-use. Owner accounts, and the tenant sites and booking data behind them, are kept while the account is active, so the business always has its history. Client data is kept for as long as the business that collected it needs it.
How we protect your information
Passwords are stored as bcrypt hashes. Sessions use httpOnly cookies. Traffic to the platform is encrypted in transit. Intake-form attachments and signatures are stored as private files and are reachable only through an admin-authenticated route, never from the public site. Access to the systems that hold your data is limited to the people who need it to run the platform.
Your rights and choices
You can ask for a copy of the information the platform holds about you, ask that it be corrected, and ask that it be deleted. To exercise any of these rights, email [email protected]. We may ask you to verify your identity first, and we will respond within the time required by law.
We do not send marketing email, so there is nothing to opt out of.
Changes to this policy
We may update this policy from time to time. When we do, we will change the effective date at the top of this page. Continued use of the platform after a change means you accept the updated policy.
Contact us
Questions about this policy, or about the information the platform holds, go to Kobe Sagami, 805-230 Roslyn Rd, Winnipeg MB CA R3L 0H1, or by email at [email protected].